| Message ID | 20240126223150.work.548-kees@kernel.org |
|---|---|
| State | New |
| Headers | show |
| Series | wifi: brcmfmac: Adjust n_channels usage for __counted_by | expand |
Hi, On 1/26/24 23:31, Kees Cook wrote: > After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct > cfg80211_scan_request with __counted_by"), the compiler may enforce > dynamic array indexing of req->channels to stay below n_channels. As a > result, n_channels needs to be increased _before_ accessing the newly > added array index. Increment it first, then use "i" for the prior index. > Solves this warning in the coming GCC that has __counted_by support: > > ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info': > ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req-> > n_channels' may be undefined [-Wsequence-point] > 3783 | req->channels[req->n_channels++] = chan; > | ~~~~~~~~~~~~~~~^~ > > Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by") > Cc: Arend van Spriel <aspriel@gmail.com> > Cc: Franky Lin <franky.lin@broadcom.com> > Cc: Hante Meuleman <hante.meuleman@broadcom.com> > Cc: Kalle Valo <kvalo@kernel.org> > Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com> > Cc: Ian Lin <ian.lin@infineon.com> > Cc: Johannes Berg <johannes.berg@intel.com> > Cc: Wright Feng <wright.feng@cypress.com> > Cc: Hector Martin <marcan@marcan.st> > Cc: linux-wireless@vger.kernel.org > Cc: brcm80211-dev-list.pdl@broadcom.com > Signed-off-by: Kees Cook <keescook@chromium.org> Thanks, patch looks good to me: Reviewed-by: Hans de Goede <hdegoede@redhat.com> Regards, Hans > --- > drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > index 133c5ea6429c..28d6a30cc010 100644 > --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > @@ -3779,8 +3779,10 @@ static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req, > if (req->channels[i] == chan) > break; > } > - if (i == req->n_channels) > - req->channels[req->n_channels++] = chan; > + if (i == req->n_channels) { > + req->n_channels++; > + req->channels[i] = chan; > + } > > for (i = 0; i < req->n_ssids; i++) { > if (req->ssids[i].ssid_len == ssid_len &&
On 1/26/24 16:31, Kees Cook wrote: > After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct > cfg80211_scan_request with __counted_by"), the compiler may enforce > dynamic array indexing of req->channels to stay below n_channels. As a > result, n_channels needs to be increased _before_ accessing the newly > added array index. Increment it first, then use "i" for the prior index. > Solves this warning in the coming GCC that has __counted_by support: > > ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info': > ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req-> > n_channels' may be undefined [-Wsequence-point] > 3783 | req->channels[req->n_channels++] = chan; > | ~~~~~~~~~~~~~~~^~ > > Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by") > Cc: Arend van Spriel <aspriel@gmail.com> > Cc: Franky Lin <franky.lin@broadcom.com> > Cc: Hante Meuleman <hante.meuleman@broadcom.com> > Cc: Kalle Valo <kvalo@kernel.org> > Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com> > Cc: Ian Lin <ian.lin@infineon.com> > Cc: Johannes Berg <johannes.berg@intel.com> > Cc: Wright Feng <wright.feng@cypress.com> > Cc: Hector Martin <marcan@marcan.st> > Cc: linux-wireless@vger.kernel.org > Cc: brcm80211-dev-list.pdl@broadcom.com > Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Thanks!
Kees Cook <keescook@chromium.org> wrote: > After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct > cfg80211_scan_request with __counted_by"), the compiler may enforce > dynamic array indexing of req->channels to stay below n_channels. As a > result, n_channels needs to be increased _before_ accessing the newly > added array index. Increment it first, then use "i" for the prior index. > Solves this warning in the coming GCC that has __counted_by support: > > ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info': > ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req-> > n_channels' may be undefined [-Wsequence-point] > 3783 | req->channels[req->n_channels++] = chan; > | ~~~~~~~~~~~~~~~^~ > > Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by") > Cc: Arend van Spriel <aspriel@gmail.com> > Cc: Franky Lin <franky.lin@broadcom.com> > Cc: Hante Meuleman <hante.meuleman@broadcom.com> > Cc: Kalle Valo <kvalo@kernel.org> > Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com> > Cc: Ian Lin <ian.lin@infineon.com> > Cc: Johannes Berg <johannes.berg@intel.com> > Cc: Wright Feng <wright.feng@cypress.com> > Cc: Hector Martin <marcan@marcan.st> > Cc: linux-wireless@vger.kernel.org > Cc: brcm80211-dev-list.pdl@broadcom.com > Signed-off-by: Kees Cook <keescook@chromium.org> > Reviewed-by: Hans de Goede <hdegoede@redhat.com> > Reviewed-by: Linus Walleij <linus.walleij@linaro.org> > Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> I'm planning to queue this for wireless tree. Arend, ack?
On 2/1/2024 11:04 AM, Kalle Valo wrote: > Kees Cook <keescook@chromium.org> wrote: > >> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct >> cfg80211_scan_request with __counted_by"), the compiler may enforce >> dynamic array indexing of req->channels to stay below n_channels. As a >> result, n_channels needs to be increased _before_ accessing the newly >> added array index. Increment it first, then use "i" for the prior index. >> Solves this warning in the coming GCC that has __counted_by support: >> >> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info': >> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req-> >> n_channels' may be undefined [-Wsequence-point] >> 3783 | req->channels[req->n_channels++] = chan; >> | ~~~~~~~~~~~~~~~^~ >> >> Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by") >> Cc: Arend van Spriel <aspriel@gmail.com> >> Cc: Franky Lin <franky.lin@broadcom.com> >> Cc: Hante Meuleman <hante.meuleman@broadcom.com> >> Cc: Kalle Valo <kvalo@kernel.org> >> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com> >> Cc: Ian Lin <ian.lin@infineon.com> >> Cc: Johannes Berg <johannes.berg@intel.com> >> Cc: Wright Feng <wright.feng@cypress.com> >> Cc: Hector Martin <marcan@marcan.st> >> Cc: linux-wireless@vger.kernel.org >> Cc: brcm80211-dev-list.pdl@broadcom.com >> Signed-off-by: Kees Cook <keescook@chromium.org> >> Reviewed-by: Hans de Goede <hdegoede@redhat.com> >> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> >> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> > > I'm planning to queue this for wireless tree. Arend, ack? This slipped past my broadcom email. As the Fixes commit is in 6.7 I would say ACK. Gr. AvS
On 2/2/2024 10:58 AM, Arend Van Spriel wrote: > On 2/1/2024 11:04 AM, Kalle Valo wrote: >> Kees Cook <keescook@chromium.org> wrote: >> >>> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct >>> cfg80211_scan_request with __counted_by"), the compiler may enforce >>> dynamic array indexing of req->channels to stay below n_channels. As a >>> result, n_channels needs to be increased _before_ accessing the newly >>> added array index. Increment it first, then use "i" for the prior index. >>> Solves this warning in the coming GCC that has __counted_by support: >>> >>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In >>> function 'brcmf_internal_escan_add_info': >>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req-> >>> n_channels' may be undefined [-Wsequence-point] >>> 3783 | req->channels[req->n_channels++] = chan; >>> | ~~~~~~~~~~~~~~~^~ >>> >>> Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct >>> cfg80211_scan_request with __counted_by") >>> Cc: Arend van Spriel <aspriel@gmail.com> >>> Cc: Franky Lin <franky.lin@broadcom.com> >>> Cc: Hante Meuleman <hante.meuleman@broadcom.com> >>> Cc: Kalle Valo <kvalo@kernel.org> >>> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com> >>> Cc: Ian Lin <ian.lin@infineon.com> >>> Cc: Johannes Berg <johannes.berg@intel.com> >>> Cc: Wright Feng <wright.feng@cypress.com> >>> Cc: Hector Martin <marcan@marcan.st> >>> Cc: linux-wireless@vger.kernel.org >>> Cc: brcm80211-dev-list.pdl@broadcom.com >>> Signed-off-by: Kees Cook <keescook@chromium.org> >>> Reviewed-by: Hans de Goede <hdegoede@redhat.com> >>> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> >>> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> >> >> I'm planning to queue this for wireless tree. Arend, ack? > > This slipped past my broadcom email. As the Fixes commit is in 6.7 I > would say ACK. Cc: to stable? Gr. AvS
Arend Van Spriel <aspriel@gmail.com> writes: > On 2/2/2024 10:58 AM, Arend Van Spriel wrote: > >> On 2/1/2024 11:04 AM, Kalle Valo wrote: >>> Kees Cook <keescook@chromium.org> wrote: >>> >>>> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct >>>> cfg80211_scan_request with __counted_by"), the compiler may enforce >>>> dynamic array indexing of req->channels to stay below n_channels. As a >>>> result, n_channels needs to be increased _before_ accessing the newly >>>> added array index. Increment it first, then use "i" for the prior index. >>>> Solves this warning in the coming GCC that has __counted_by support: >>>> >>>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In >>>> function 'brcmf_internal_escan_add_info': >>>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req-> >>>> n_channels' may be undefined [-Wsequence-point] >>>> 3783 | req->channels[req->n_channels++] = chan; >>>> | ~~~~~~~~~~~~~~~^~ >>>> >>>> Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct >>>> cfg80211_scan_request with __counted_by") >>>> Cc: Arend van Spriel <aspriel@gmail.com> >>>> Cc: Franky Lin <franky.lin@broadcom.com> >>>> Cc: Hante Meuleman <hante.meuleman@broadcom.com> >>>> Cc: Kalle Valo <kvalo@kernel.org> >>>> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com> >>>> Cc: Ian Lin <ian.lin@infineon.com> >>>> Cc: Johannes Berg <johannes.berg@intel.com> >>>> Cc: Wright Feng <wright.feng@cypress.com> >>>> Cc: Hector Martin <marcan@marcan.st> >>>> Cc: linux-wireless@vger.kernel.org >>>> Cc: brcm80211-dev-list.pdl@broadcom.com >>>> Signed-off-by: Kees Cook <keescook@chromium.org> >>>> Reviewed-by: Hans de Goede <hdegoede@redhat.com> >>>> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> >>>> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> >>> >>> I'm planning to queue this for wireless tree. Arend, ack? >> This slipped past my broadcom email. As the Fixes commit is in 6.7 I >> would say ACK. Thanks. > Cc: to stable? Is commit e3eac9f32ec0 in stable releases? (I don't follow stable and don't know what commits they take.) I propose that as we have Fixes tag let's not add cc but instead let stable maintainers to decide.
Kees Cook <keescook@chromium.org> wrote: > After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct > cfg80211_scan_request with __counted_by"), the compiler may enforce > dynamic array indexing of req->channels to stay below n_channels. As a > result, n_channels needs to be increased _before_ accessing the newly > added array index. Increment it first, then use "i" for the prior index. > Solves this warning in the coming GCC that has __counted_by support: > > ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info': > ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req-> > n_channels' may be undefined [-Wsequence-point] > 3783 | req->channels[req->n_channels++] = chan; > | ~~~~~~~~~~~~~~~^~ > > Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by") > Cc: Arend van Spriel <aspriel@gmail.com> > Cc: Franky Lin <franky.lin@broadcom.com> > Cc: Hante Meuleman <hante.meuleman@broadcom.com> > Cc: Kalle Valo <kvalo@kernel.org> > Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com> > Cc: Ian Lin <ian.lin@infineon.com> > Cc: Johannes Berg <johannes.berg@intel.com> > Cc: Wright Feng <wright.feng@cypress.com> > Cc: Hector Martin <marcan@marcan.st> > Cc: linux-wireless@vger.kernel.org > Cc: brcm80211-dev-list.pdl@broadcom.com > Signed-off-by: Kees Cook <keescook@chromium.org> > Reviewed-by: Hans de Goede <hdegoede@redhat.com> > Reviewed-by: Linus Walleij <linus.walleij@linaro.org> > Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Patch applied to wireless.git, thanks. 5bdda0048c8d wifi: brcmfmac: Adjust n_channels usage for __counted_by
On 2/2/2024 11:34 AM, Kalle Valo wrote: > Arend Van Spriel <aspriel@gmail.com> writes: > >> On 2/2/2024 10:58 AM, Arend Van Spriel wrote: >> >>> On 2/1/2024 11:04 AM, Kalle Valo wrote: >>>> Kees Cook <keescook@chromium.org> wrote: >>>> >>>>> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct >>>>> cfg80211_scan_request with __counted_by"), the compiler may enforce >>>>> dynamic array indexing of req->channels to stay below n_channels. As a >>>>> result, n_channels needs to be increased _before_ accessing the newly >>>>> added array index. Increment it first, then use "i" for the prior index. >>>>> Solves this warning in the coming GCC that has __counted_by support: >>>>> >>>>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In >>>>> function 'brcmf_internal_escan_add_info': >>>>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req-> >>>>> n_channels' may be undefined [-Wsequence-point] >>>>> 3783 | req->channels[req->n_channels++] = chan; >>>>> | ~~~~~~~~~~~~~~~^~ >>>>> >>>>> Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct >>>>> cfg80211_scan_request with __counted_by") >>>>> Cc: Arend van Spriel <aspriel@gmail.com> >>>>> Cc: Franky Lin <franky.lin@broadcom.com> >>>>> Cc: Hante Meuleman <hante.meuleman@broadcom.com> >>>>> Cc: Kalle Valo <kvalo@kernel.org> >>>>> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com> >>>>> Cc: Ian Lin <ian.lin@infineon.com> >>>>> Cc: Johannes Berg <johannes.berg@intel.com> >>>>> Cc: Wright Feng <wright.feng@cypress.com> >>>>> Cc: Hector Martin <marcan@marcan.st> >>>>> Cc: linux-wireless@vger.kernel.org >>>>> Cc: brcm80211-dev-list.pdl@broadcom.com >>>>> Signed-off-by: Kees Cook <keescook@chromium.org> >>>>> Reviewed-by: Hans de Goede <hdegoede@redhat.com> >>>>> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> >>>>> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> >>>> >>>> I'm planning to queue this for wireless tree. Arend, ack? >>> This slipped past my broadcom email. As the Fixes commit is in 6.7 I >>> would say ACK. > > Thanks. > >> Cc: to stable? > > Is commit e3eac9f32ec0 in stable releases? (I don't follow stable and > don't know what commits they take.) I propose that as we have Fixes tag > let's not add cc but instead let stable maintainers to decide. I confirmed the commit was in 6.7 and the latest released kernel is always handled by stable kernel team. kernel.org main page always shows the active stable/longterm releases. That said I have no problem with your proposal. Gr. AvS
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index 133c5ea6429c..28d6a30cc010 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -3779,8 +3779,10 @@ static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req, if (req->channels[i] == chan) break; } - if (i == req->n_channels) - req->channels[req->n_channels++] = chan; + if (i == req->n_channels) { + req->n_channels++; + req->channels[i] = chan; + } for (i = 0; i < req->n_ssids; i++) { if (req->ssids[i].ssid_len == ssid_len &&
After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by"), the compiler may enforce dynamic array indexing of req->channels to stay below n_channels. As a result, n_channels needs to be increased _before_ accessing the newly added array index. Increment it first, then use "i" for the prior index. Solves this warning in the coming GCC that has __counted_by support: ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info': ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req-> n_channels' may be undefined [-Wsequence-point] 3783 | req->channels[req->n_channels++] = chan; | ~~~~~~~~~~~~~~~^~ Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by") Cc: Arend van Spriel <aspriel@gmail.com> Cc: Franky Lin <franky.lin@broadcom.com> Cc: Hante Meuleman <hante.meuleman@broadcom.com> Cc: Kalle Valo <kvalo@kernel.org> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com> Cc: Ian Lin <ian.lin@infineon.com> Cc: Johannes Berg <johannes.berg@intel.com> Cc: Wright Feng <wright.feng@cypress.com> Cc: Hector Martin <marcan@marcan.st> Cc: linux-wireless@vger.kernel.org Cc: brcm80211-dev-list.pdl@broadcom.com Signed-off-by: Kees Cook <keescook@chromium.org> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)